If they're collecting biometric data without posting a sign they are breaking the law, that requirement to post a sign is why this story about Wegmans is public at all, Wegmans posted signs as required.

If they are, and aren't posting signs, that would be a story in itself. Of course it could still be happening, it sounds like the law is fairly toothless, but it did get Wegmans to post the sign, so probably not useless.

https://gothamist.com/news/nyc-wegmans-is-storing-biometric-...